[1]} adapted differentially-private gradient-based training (DP-SGD) [2]} to GCNs for natural language processing task. However, as noted by the authors, the privacy guarantees of their approach might not hold because (DP-SGD) requires a set of i.i.d. examples to form batches and lots in order to distribute the noise effectively, whereas, in GNNs, the nodes exchange information via the message passing framework during training. To the best of our knowledge, this is the only previous work that assumes a non-distributive setting and the sensitivity of the whole private graph, including the other data like node features and labels.
